Apache Traffic Server CVE-2026-58178

Exploitation requires that the Apache Traffic Server deployment has the ESI plugin enabled and processing responses (the plugin is optional and not loaded by default), and that the attacker can influence ESI markup reaching the plugin so that recursive/nested include directives pointing to attacker-controlled URLs are processed. The CVSS 4.0 vector marks PR:N/UI:N (no authentication or user interaction) but AT:P, indicating a specific attack requirement must be met - consistent with needing the ESI feature active and attacker-influenced ESI content. The primary limiting factor is therefore configuration: sites that do not run the ESI plugin are not exposed, which substantially narrows the real-world attack surface relative to the raw 8.2 score.

Signals are moderately consistent and point to a real but bounded risk. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) rates this as network-reachable and unauthenticated with a present attack requirement (AT:P), and scores impact solely as availability (VA:H) with no confidentiality or integrity impact, yielding 8.2 (High). Notably, the input Tags label this 'Information Disclosure', which conflicts with the CVSS impact metrics that rate only availability - the recursion fetching attacker-controlled URLs has SSRF-like characteristics that could enable information disclosure, but the vendor did not rate confidentiality impact; this discrepancy should be verified against the vendor advisory. There is no EPSS score, no SSVC decision data, no CISA KEV listing, and no evidence of a public POC in the provided data, so this is best treated as a patch-on-normal-cycle availability issue rather than an emergency, with the caveat that exploitation only matters where the optional ESI plugin is actually deployed.

An attacker who can cause the ESI plugin to process crafted ESI markup - for example by controlling or poisoning an origin response, or by injecting nested include directives - submits content that references further includes recursively. The ESI plugin follows these without a depth limit, recursing and repeatedly fetching attacker-controlled URLs until CPU, memory, or connection resources on the Traffic Server node are exhausted, degrading or denying service for legitimate clients. No public POC is identified at time of analysis.